1. Meeting Minutes and TODOs TG has no distributed monitoring. During incident response, use a manual twiki page to distribute information TG monitors the recognized key files against the ssh incidents EGEE uses RSV probes and sites run Nagios tools. SAM probes are used by VOs? EGEE monitors whether sites installed the released patches. – EGEE assumes env at Gatekeeper and env at WN are identical Comment1: availability of security services takes up a lot of operational security. What other operational aspects are under security team’s responsibility TODO1: list the operational security responsibilities of the security team TODO2: Risk assessment must be done before the monitoring decisions are made. The security budget must be taken into account Comment2: sending usage (gratia) reports directly to users. TODO3: Write generic RSV probes to observe if sites have downloaded the patches (Ruth) 102/09OSG Security Review

2. TODO4: Identify when do we publicly announce the security vulnerabilities to our site and VO communities. If we delay the announcement due to a delay in finding a fix, we must make this policy explicit to our sites Comment: incident spread happens due to two aspects: community and software. Non-grid community can affect the incident spread Comment: our definition of incident is different than EGEE. EGEE’s include only malicious exploits TODO5: how we decide to kick a site off of OSG. – Quiz for site admins to demonstrate their security knowledge on OSG practices and policies TODO6: Engagement and Education team must speak the same security materials to incoming security users. A security welcome kit. England achieves this via site visits by security person. Ensure that we do speak the same material TODO7: What is the right metric to measure effectiveness of security team TODO8: What is the right metric to measure site’s security effectiveness TODO9: Can we measure the productivity lost due to security incidents. Include this in your security ticketing information TODO10: how do you ensure the security team’s online survey invitations are protected so that ST&E control results are reliable ? 202/09OSG Security Review

3. Comment: making security policies to keep up with JSPG and keep JSPG happy is not a very good idea. Executive decision is needed to spending less time Comment: On the policy work: OSG brings a sort of uniformity to sites and users such that users have less difficulty in finding sites with compliant policies. If OSG defines this out of the scope for its work, the burden will fall on the user Comment: On software vulnerability: we can give priority to the software produced by OSG. Evaluating other software is too time consuming for a small team like OSG. Why is this security team’s priority. Either outsource or ask VDT team’s help Comment: admin needs to know: downloading OSG service does not increase the risk at the site. – The risk will inherently increase because the site is opening up to new users TODO11: Learn to monitor how quickly sites download security fixes. TODO12: Define the procedure for announcing security advisories for the software vulnerabilities. Either refer to existing CVE numbers or consider getting CVE number. On the down side, CVE numbers will bring an increased exposure and can increase attack risk Comment: EGEE has a quarantine period by the end of which either an announcement to the sites are made, or a fix is released. 302/09OSG Security Review

4. TODO13: Understand the value of 24*7 service. Even when security team is 24*7, it cannot do anything with site and VO security contacts who aren’t 24*7. – Does this bring us an illusion of safety? – Weekends are especially problematic for reaching security personnel at sites Comment: SuperComputer Centers are not 24*7. TG security team and help desk is 24*7 TODO14: understand the relationship between GOC and VDT ticketing system. Software vulnerabilities are ticket in GOC. Security team does not open tickets with VDT TODO15: Include information leak as a risk in risk assessment document. Reputation aspect of our project must be regarded as a high loss. TODO16: media training for security team TODO17: write in incident response process explicitly about the confidentiality of the data exchanged between sites, users and security team. Comment: on future growth expectation: sites will grow 10%. VOs won’t grow. Users will grow within existing VOs. TODO18: list your top ten concerns regarding the security TODO19: how does sites requests/requirements be incorporated into security team’s WBS? 402/09OSG Security Review